WordPress.org

Weston Ruter

WordPress Performance Team

This plugin was formerly called as “No-cache BFCache”, which admittedly was a poor jargony name and was too narrowly scoped.
This plugin enables instant back/forward navigation via the browser’s <a href="https://developer.mozilla.org/en-US/docs/Glossary/bfcache" rel="nofollow ugc">bfcache</a>. It does this by removing the <code>no-store</code> directive from the <code>Cache-Control</code> response header, which WordPress sends by default when <code>nocache_headers()</code> is called. This happens primarily when a user is logged in, but some plugins may send these “no-cache” headers such as on the Cart or Checkout pages for an e-commerce site. Upon activation, to see the effect, you must log out of WordPress and log back in again, ensuring “Remember Me” is checked. Even so, another plugin, theme or server configuration may be active which makes pages <a href="https://web.dev/articles/bfcache#optimize" rel="nofollow ugc">ineligible for bfcache</a> due to other <a href="https://developer.mozilla.org/en-US/docs/Web/API/Performance_API/Monitoring_bfcache_blocking_reasons#blocking_reasons" rel="nofollow ugc">blocking reasons</a>. Nevertheless, the removal of <code>no-store</code> will still speed up back/forward navigations since pages may then be served from the browser’s HTTP cache, eliminating the need to re-download the HTML from the server. This is a feature plugin to implement <a href="https://core.trac.wordpress.org/ticket/63636" rel="nofollow ugc">#63636</a> in WordPress core.
Blog post: <a href="https://weston.ruter.net/2025/07/23/instant-back-forward-navigations-in-wordpress/" rel="nofollow ugc">Instant Back/Forward Navigations in WordPress</a>
The speed of page navigations in WordPress saw a big boost in 6.8 with the introduction of <a href="https://make.wordpress.org/core/2025/03/06/speculative-loading-in-6-8/" rel="nofollow ugc">Speculative Loading</a>. However, by default Speculative Loading in WordPress is not configured to enable instant page loads, which requires a non-conservative eagerness with the prerender mode; not all sites can even opt in to prerendering due to compatibility issues, such as with analytics, and due to concerns about sustainability with unused prerenders (e.g. increasing server load and taxing a user’s bandwidth/CPU). While Speculative Loading (i.e. the Speculation Rules API) is relatively new and currently only supported in Chromium browsers (e.g. Chrome and Edge), there is a much older web platform technology that enables prerendering and which is supported in all browsers: the back/forward cache (bfcache). This instant loading involves no network traffic and no CPU load, since previously visited pages are stored in memory. According to the web.dev article on <a href="https://web.dev/articles/bfcache" rel="nofollow ugc">back/forward cache</a>:
Chrome usage data shows that 1 in 10 navigations on desktop and 1 in 5 on mobile are either back or forward. With bfcache enabled, browsers could eliminate the data transfer and time spent loading for billions of web pages every single day!
Also learn more via the following video:
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/Y2IVv5KnrmI?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
Normally, WordPress sends a <code>Cache-Control</code> header with the <code>no-store</code> directive when a user is logged in. This has the effect of <a href="https://web.dev/articles/bfcache#minimize-no-store" rel="nofollow ugc">breaking the browser’s bfcache</a>, which means that navigating back or forward in the browser requires the pages to be re-fetched from the server and for any JavaScript on the page to re-execute. The result can be a sluggish navigation experience not only when navigating around the WP Admin (see <a href="https://github.com/Automattic/jetpack/pull/44322#:~:text=page%20load%20is%3A-,Without%20bfcache,-With%20bfcache" rel="nofollow ugc">Jetpack demo video</a> and demo video below) but also when navigating around the frontend of a site. Furthermore, the lack of bfcache can cause data loss when data has been entered via a JavaScript-built UI since this state is lost when a page is not restored via bfcache (see <a href="https://github.com/woocommerce/woocommerce/pull/58445#issuecomment-3014404754" rel="nofollow ugc">WooCommerce demo video</a> and demo video below).
The reason why the <code>no-store</code> directive was added in the first place was due to a privacy concern where an authenticated user may log out of WordPress, only for another person to access the computer and click the back button to view the contents of the authenticated page loaded from bfcache or the HTTP cache. (See <a href="https://core.trac.wordpress.org/ticket/21938" rel="nofollow ugc">#21938</a>.) In practice this issue depends on the user being on a shared computer who didn’t exit the browser, and it requires the malicious user to act soon before the page is evicted from bfcache (e.g. Chrome as a <a href="https://developer.chrome.com/docs/web-platform/bfcache-ccns#:~:text=The%20bfcache%20timeout%20for%20Cache%2DControl%3A%20no%2Dstore%20pages%20is%20also%20reduced%20to%203%20minutes%20(from%2010%20minutes%20used%20for%20pages%20which%20don%27t%20use%20Cache%2DControl%3A%20no%2Dstore)%20to%20further%20reduce%20risk." rel="nofollow ugc">10-minute timeout</a>).
To address this privacy concern, a safeguard is in place to protect against restoring pages from bfcache and the HTTP cache after the user has logged out:
When authenticating to WordPress, a “bfcache session token” cookie is set along with the other authentication cookies. This cookie is not HTTP-only so that it can be read in JavaScript; it is a random string not used for any other purpose. When an authenticated page is served, this bfcache session token is included in the HTML as well as a script which reads the value of this cookie. When a user navigates away from the page and then navigates back to it, a script on the page checks if the current session token in the cookie matches the initial session token sent with the page. If they do not match (e.g. because the user has logged out or another user has logged in), then the contents of the page are cleared and the page is reloaded so that the contents are not available.
Since JavaScript is required to invalidate cached pages, the login form is extended to pass along whether scripting is enabled. Only when JS is enabled will the <code>no-store</code> directive be omitted from the <code>Cache-Control</code> response header. This ensures that users with JavaScript turned off will retain the privacy protection after logging out. Lastly, <code>no-store</code> is also only omitted if the user checked the “Remember Me” checkbox on the login form. Since it is highly unlikely a user on a shared computer would have checked this checkbox, this provides yet an additional safeguard (which may in the end prove excessive). A ✨ emoji is displayed next to the checkbox in a button that opens a popover that promotes the capability. If you want to opt out of this opt-in (and the sparkle) so that all logged-in users get bfcache, you can use the <code>nocache_bfcache_use_remember_me_as_opt_in</code> filter which you can use in a custom plugin or your theme:
<pre>add_filter( 'nocache_bfcache_use_remember_me_as_opt_in', '__return_false' );</pre>
When this plugin strips out the <code>no-store</code> directive, it also ensures that the <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control#private" rel="nofollow ugc"><code>private</code> directive</a> is sent in its place: “The <code>private</code> response directive indicates that the response can be stored only in a private cache (e.g., local caches in browsers).” WordPress is already sending <code>private</code> as of <a href="https://core.trac.wordpress.org/ticket/57627" rel="nofollow ugc">#57627</a>. This directive ensures that proxies do not cache authenticated pages. In addition to ensuring <code>private</code> is present, this plugin also adds <code>no-cache</code>, <code>max-age=0</code>, and <code>must-revalidate</code> while ensuring <code>public</code> is removed, all to further guard against any misconfigured proxy from caching the private response.
<h4>Demo: Navigating the WordPress Admin</h4>
Without bfcache:
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/Cz-_L6q9ZRc?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&start=22&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
With bfcache:
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/z4dILiwe0Rk?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&start=27&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
<h4>Demo: Navigating the WordPress Frontend</h4>
Without bfcache: The drafted BuddyPress activity update is lost when navigating away from the page before submitting. The activity feed and Tweet have to be reconstructed with each back/forward navigation.
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/Ko1w_SRlCig?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
With bfcache: The drafted BuddyPress activity update is preserved when navigating away from the page without submitting. The activity feed and Tweet do not have to be reconstructed when navigating to previously visited pages via the back/forward buttons.
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/bzGm6LcHHAs?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>

Instant Back/Forward


This is now a "must install" plugin for me on every site I work on. It's absolutely magical.


Magical

Enables back/forward cache (bfcache) for instant history navigations even when “nocache” headers are sent, such as when a user is logged in.

SpinupWP

This plugin ensures that the SpinupWP page cache is cleared when your site’s content changes. Not using SpinupWP yet? <a href="https://spinupwp.com/pricing/" rel="nofollow ugc">Sign up here.</a>
SpinupWP is a modern server control panel that’s here to help you implement best practices for every server you spin up. Designed for WordPress.
This companion plugin should be installed on sites created using SpinupWP to allow the page cache to be cleared when your site’s content changes. Not using SpinupWP yet? <a href="https://spinupwp.com/pricing/" rel="nofollow ugc">Sign up here.</a>
Any Provider
We support DigitalOcean, Linode, AWS, and any other provider. If your server has an IP address, you can connect SpinupWP. It does need to be a fresh install of Ubuntu though.
Latest & Greatest Software
SpinupWP will install the latest stable versions of Nginx, PHP, MySQL/MariaDB, and Redis from the standard apt-get repos. No who-knows-what-they-did custom builds of packages. Disconnect from SpinupWP in the future and you can still keep your packages up-to-date with apt-get upgrade.
Automatic Security Updates
SpinupWP will configure your server to install security updates as soon as they are available to reduce the likelihood of a software vulnerability putting your server at risk.
Free SSL/TLS Certificates
Serving your site over HTTPS is essential these days, not only for security, but to take advantage of the performance improvements of HTTP/2 as well. When you add a site to SpinupWP, a free Let’s Encrypt SSL/TLS certificate will be acquired, installed, and configured for your site. And SpinupWP will handle certificate renewals as well, so you hardly need to think about certificates.
Cache All the Things
One of the keys to a great performing WordPress site is caching. All sites are set up with Redis object caching to greatly reduce database requests. And with the check of a box you can enable full-page caching to serve pages lightning fast without even hitting PHP.
Git Push-to-Deploy
Developers! Developers! Developers! Add a git repository to your SpinupWP site and simply push to master to deploy your code. GitHub, Bitbucket, or a custom git repo will work. You can also configure a build script to run some tasks on the server after deployment is complete.
Error Logs
WordPress doesn’t enable error logging by default. Probably because the log is saved to a publicly accessible directory and can quickly balloon to take up a lot of hard drive space. SpinupWP enables error logs by default but stores them in a safe place and makes sure they’re rotated regularly like other server logs.
Security Security Security
Each server provisioned by SpinupWP is security-hardened from the word go. SSH login is disabled for the root user (you login with your user and use sudo instead). The firewall only allows connections to Nginx and SSH and failed attempts are monitored and blocked when the reach a threshold. Nginx is configured to defend against XSS, clickjacking, MIME sniffing, and other attacks. Software security updates are installed automatically.
Scheduled Posts Published on Schedule
For every site you add via SpinupWP, a server-side cron job will be configured to make sure that your WordPress site’s cron is executed every minute, as it should be.
WP-CLI Preloaded
If you love WP-CLI (we do! ❤) you’ll be very pleased to find it available on the command line the first time you login to your server.
Security Isolation for Sites
For each site that you add to your server via SpinupWP, a new system user is created for that site. All site files are owned by the site user and a PHP-FPM pool is configured to run as that user as well. Each site only has access to its files and so if only one site has a security vulnerability and gets infected with malware for example, only the files for that one site can be infected.
SFTP Access for Your Clients
If you’re hosting a site for someone else, you can easily give them SFTP/SSH access to just that site. And because of the security isolation between sites, they will only have access to files for that site.
Professional Guidance & Best Practices
SpinupWP will actively point you in the right direction and offer suggestions for maintaining your server. And because it provides detailed feedback about the operations it runs on your server, you can learn what is happening with your server. New release of Ubuntu just came out, should I upgrade? We’ll add a notice to the app about that, why we don’t recommend upgrading your existing servers, and how you can spin up a new server with the new release of Ubuntu and migrate your sites to that server instead. Should I install Varnish to improve page caching performance? We’ve benchmarked Varnish and Nginx FastCGI Cache performed better. Varnish would add complexity too, so one less moving part is another reason. Much of the time SpinupWP will suggest things that you may not have even thought of. Email deliverability for example. SpinupWP will strongly encourage you to configure an email sending plugin for the best email deliverability. SpinupWP’s guidance is especially helpful for those new to managing a server, but can also help those who’ve been at it a while, providing transparency to our decisions.
Scheduled Backups of Site Files & Database
All server providers (DigitalOcean, Linode, etc) offer automated backups of your entire server for a fee. These services are great and we highly recommend having backups of your whole server. But what happens if some media or data was deleted by accident from your WordPress site? You’re not going to restore your entire server just to get that data back. That’s where site backups come in. Site backups are full backups of your site files (media, themes, and plugins) and database. They allow you to easily restore a single site or just some files or data from a single site. With SpinupWP’s site backups, you choose your preferred provider to stash your backups whether that’s Amazon S3, DigitalOcean Spaces, or Google Cloud Storage. You plug in your account details and SpinupWP will send your site backups there in an easy-to-see format.
Teamwork Makes the Dream Work
Create a new team account, invite a member of your team, and allow them to spin up their own servers. Or just only allow them to add sites, the permissions you give them is up to you.
<h4>Features</h4>
<ul>
<li>Page cache purging</li>
<li>Persistent object caching</li>
<li>Ensures debug.log files aren’t saved in a publicly-accessible location</li>
</ul>

The plugin is the perfect complement to one of the best, most well-crafted services I've used in years. I can't promote it enough. 

If I could write two reviews to give it 10 stars, I would.

I'm such a fan of the service at SpinupWP. 

Is it for everyone? Certainly not. You're far more "on your own" to deal with issues on your sites. 

But if you're comfortable enough to use a service like Digital Ocean, but not comfortable enough to be a full-on database administrator, SpinupWP fills a gigantic need in your life. 

Most importantly, keeping everything up to date is super mega simple, and explained in words I understand. 

SpinupWP is like having an expert looking over your shoulder

Incredible service

SpinupWP is a modern server control panel that's here to help you implement best practices for every server you spin up. Designed for WordPress.

Instant Back/Forward vs SpinupWP